Description

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-12T20:17:55.197Z",
  "pubdate": "2026-08-12T20:17:55.197Z",
  "executiveSummary": "CamaleonCMS version 2.9.1 suffers from a Server-Side Template Injection (SSTI) vulnerability residing within the administrative settings functionality. The flaw allows authenticated administrators to achieve arbitrary remote code execution within the context of the underlying Ruby on Rails process.\nThe vulnerability is triggered by supplying crafted input containing Embedded Ruby (ERB) tags via the email parameter in the test_email settings action. When the application handles an SMTP rejection, it reflects the recipient address back into an exception message which is subsequently processed by the Rails inline template renderer.\nSuccessful exploitation grants attackers full arbitrary command execution capabilities as the Rails process user, leading to complete compromise of the affected web application. The attack requires administrative privileges and access to the admin settings endpoint.\nThis high-risk vulnerability exposes the host system to severe operational disruption, data exfiltration, and lateral movement if the underlying process permissions are overly permissive.",
  "technicalDetails": "The vulnerability exists within the email parameter handling of the test_email settings action in CamaleonCMS 2.9.1. The root cause is insecure template rendering, where untrusted user input is passed into an evaluation context capable of processing Ruby code.\nExploitation occurs when an attacker with administrative privileges submits a malicious payload containing ERB expressions (e.g., <% system('...') %>) through the vulnerable test_email endpoint.\nThe attack flow proceeds as follows: First, the administrator or an attacker possessing valid administrative credentials interacts with the test_email functionality, injecting the ERB payload into the email parameter. Second, the application attempts to dispatch a test email via SMTP, triggering a rejection or handling the exception path. Third, the application includes the recipient address containing the malicious ERB tags within the exception message. Finally, the Rails inline template renderer processes the exception message, evaluating the embedded Ruby syntax and executing arbitrary operating system commands with the privileges of the Rails process user.\nThe vulnerable component involves the email configuration test routine and the Rails inline template rendering engine handling exception feedback. The affected software version is CamaleonCMS 2.9.1. Prerequisites for a successful attack include authenticated access to the administrative panel and specific interaction with the admin settings test_email endpoint over the network."
}